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Abstract 

An embedded cryptographic system comprises at least one test plaintext/ciphertext pair 
P i? Cj for which the key has been destroyed or stored at a very safe place. If at some later date, at 
least one apoptosis key Kj is presented to the cryptographic system which has the property that Q 
is the enciphered image of Pj under Kj, then the algorithm could be broken and should not be 
used any more. Instead a more conservative algorithm should be used. The method for changing 
the ciphering by an embedded cryptographic system includes the step of checking whether at 
least one test ciphertext Cj is the enciphered image of a corresponding test plaintext Pj under an 
apoptosis key Kj and the step of switching off the used cryptographic mode in case of a positive 
checking result. In ord e r to enable the st e p of chocking a protocol has to d e fine a control stream 
with at l e ast on e key to b e checked. Th e checking will b e done as soon as such as control stream 
is receiv e d by the cryptographic system. The advantage of this solution is the fact, that there is 
not n ee d for controlling resp e ctiv e ly trusting the manufactur e r or a security s e rvice. The 
e mbedded cryptographic system can r e ceive the key or a collection of keys (K j ) from anywhere. 


